A general method for preventing jump board based on Ethernet bridge rules

Abstract

The invention discloses a general method for preventing a jump board machine based on Ethernet bridge rules. The method adopts a configuration mode of filtering data packets through Ethernet bridges, and uses ebtables, a configuration tool for filtering data packets at the data link layer in the Linux kernel. When a data packet is sent to a Linux host machine, the host machine detects and processes the filtering rules of the data packet and filters it. Since a honeypot deployed with multiple VLANs is bridged on the Linux host machine, when an attacker attacks the honeypot, ebtables is used to restrict the FORWARD chain. The FORWARD chain rules do not enter the user control and are responsible for forwarding data packets that flow through the host but do not enter the local machine. The invention adopts an Ethernet bridge rule, bridges multiple VLANs on the Linux host machine to create a large number of honeypots, and forms a honeynet deployed on a large scale. By limiting and allowing the operation of port traffic, the honeypot is independent of the real business and performs an anti-jump board operation.

Description

Technical Field

[0001] The invention relates to the technical field of network information security, and in particular to a general method for preventing a board jump machine based on Ethernet bridge rules. Background Art

[0002] In the existing technology, the anti-jumpboard method is to add a firewall to the overall business scope, or to configure a firewall on each honeypot to perform anti-jumpboard protection. However, adding a firewall to the overall business scope is likely to affect the existing business functions and is not conducive to flexible configuration. If the honeypot is configured with its own firewall for anti-jumpboard, it is easy for the attacker to modify the anti-jumpboard after obtaining the super administrator privileges, making it invalid. Summary of the invention

[0003] Purpose of the invention: The purpose of the present invention is to address the deficiencies of the prior art and provide a general method for preventing board jumping based on Ethernet bridge rules. By limiting and allowing port traffic operations, the honeypot can be independent of the real business, solving the problem of the host machine directly limiting the traffic of the bridged honeypot.

[0004] The present invention discloses a general method for preventing a jump board based on Ethernet bridge rules, which is characterized by comprising the following steps:

[0005] Step 1: Bridge the honeypot deployed in multiple VLANs to the Linux host so that all network traffic destined for the honeypot is forwarded through the Linux host;

[0006] Step 2: Use the Ethernet bridge to filter data packets. When the data packets reach the data link layer, use the ebtables tool in the Linux kernel to filter data packets at the data link layer. Configure the rules for filtering data packets. The system detects the filtering rules of the corresponding nodes and performs filtering.

[0007] Step 3: After configuration, when a data packet is sent to the Linux host, the Linux host detects the filtering rules for the data packet and performs filtering;

[0008] Step 4: When an attacker attacks the honeypot, use ebtables to restrict the FORWARD chain. Ebtables is used to filter Ethernet frames. When configuring the FORWARD parameters, DROP the frames from the honeypot to the real business and allow the attacker's frames to the honeypot.

[0009] Furthermore, the configuration of ebtables is divided into three levels: table, chain and rule. Each chain is provided with a series of rules, and each rule defines a series of filtering options.

[0010] Furthermore, the FORWARD chain rule does not enter the user control and is responsible for forwarding data packets that flow through the host but do not enter the local machine.

[0011] Furthermore, the honeypot is a bridged Kvm virtual machine.

[0012] Furthermore, the filtering rules are ebtables Ethernet bridge firewall rules configured on the Linux host machine.

[0013] The beneficial effects brought by the technical solution of the present invention are:

[0014] 1. Use a new Ethernet bridge firewall to control the flow of honeypots. It is easier to manage by performing anti-jump board operations on the host machine than directly on the honeypot. It also avoids the failure of the anti-jump board mechanism after the honeypot is compromised.

[0015] 2. Enable operation and maintenance personnel to directly control traffic through the Ethernet bridge firewall, and perform more convenient and safer anti-jump board configuration after large-scale deployment of honeynets;

[0016] 3. Since the honeypot itself is used to trap attackers, strengthening the honeypot anti-jumpboard mechanism can also prevent attackers from moving laterally within the intranet and protect other assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 The figure is a schematic diagram of a general method for preventing a board jumper based on Ethernet bridge rules of the present invention. DETAILED DESCRIPTION

[0018] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0019] The present invention discloses a general method for preventing a jump board machine based on Ethernet bridge rules, comprising the following steps:

[0020] Step 1: Bridge the honeypot deployed in multiple VLANs to the Linux host.

[0021] In this step, a large number of honeypots are created on multiple VLANs on the Linux host using a bridging method to form a honeynet deployed on a larger scale. The Linux host has an address on each VLAN, and creates honeypots with IP addresses in these VLANs to increase authenticity and coverage. Among them, the honeypot is a virtual machine that induces attackers to attack. The honeypot is deployed in reality. The honeypot on the Linux host is connected to the network directly connected to the host through bridging technology. At the same time, because it is a bridging method, the network traffic is forwarded through the Linux host, that is, all traffic flowing to the destination honeypot will pass through the Linux host, therefore, an excellent flow control mechanism is formed, that is, all honeypot traffic is controlled by the Linux host. If the host does not forward, the traffic cannot enter the honeypot and is also not forwarded. However, the bridged traffic cannot be restricted by the dynamic firewall firewalld and static firewall iptables that come with the Linux host. Firewalld and iptables can only limit the inbound and outbound traffic of the Linux host itself (that is, the source or destination is the Linux host itself). The source or destination is the honeypot bridged on the Linux host, and the host has no way to limit it through its own firewalld and iptables. Therefore, a data link layer firewall method is adopted, that is, ebtables is implemented. Ebtables is a firewall module that comes with the Linux kernel. There are two types of traffic flowing through the local machine. One is that at least one of the source or destination is the local machine, which is restricted by iptables, and the other is that neither the source nor the destination is the local machine. Ebtables can be configured as a supplement to the common firewall.

[0022] Step 2: Use the Ethernet bridge to filter data packets and use the ebtables tool in the Linux kernel to configure the data link layer traffic filtering data packets.

[0023] In this step, Ethernet bridge is used to filter data packets, and the configuration tool ebtables is used for configuration. Ebtables is an Ethernet bridge firewall, which is a Linux firewall module that specifically manages bridge traffic. The configuration of ebtables mainly involves configuring rules. Like common firewalls, the object of configuration is the firewall rule. The rules clearly define the type of traffic that can be accepted, or reject operations, so as to achieve the effect of restriction.

[0024] From entering to leaving the system, the data packet goes through five stages: PreRoute, Input, Forward, Output, and PostRoute. Each stage includes multiple nodes, and each node is a filtering opportunity. When the data packet travels to a node, the system detects the filtering rules of the corresponding node and filters it.

[0025] The ebtables configuration is divided into tables, chains, and rules. Each chain has a series of rules, and each rule defines some filtering options. Each data packet will match these items, and once a match is successful, the corresponding action will be executed. The action is the filtering behavior, and there are four types of filtering behaviors, including ACCEPT, DROP, RETURN, and CONTINUE. The most commonly used ones are ACCEPT and DROP.

[0026] Step 3: After configuration, when a data packet is sent to the Linux host, the Linux host detects the filtering rules for the data packet and performs filtering.

[0027] In this step, the filter rule is the ebtables filter rule, and the specific parameters are specified, such as -t specifies the table, -I or -A specifies the order of inserting rules, -p specifies ipv4 or ipv6, --ip-dst specifies the destination address of the data packet, --ip-proto specifies the protocol (tcp, udp or icmp), and -j specifies the operation (ACCEPT to accept the data packet or DROP to discard the data packet, etc.).

[0028] Step 4: When an attacker attacks the honeypot, use ebtables to restrict the FORWARD chain. Ebtables is used to filter Ethernet frames. When configuring the FORWARD parameters, DROP the frames from the honeypot to the real business and allow the attacker's frames to the honeypot.

[0029] In this step, for the forward chain found at the data link layer, the source and destination of the bridge traffic are not the local machine, and ebtables is used to specify -I FORWARD to restrict the flow. For example, ebtables -t filter -A FORWARD -p IPv4 --ip-dst 10.0.0.0 / 8 --ip-proto tcp -j DROP. Use DROP to restrict the flow. If the flow is not accepted, the passing data packets are directly discarded.

[0030] In the present invention, an Ethernet bridge is used to solve the flow control problem of a honeypot bridged on a Linux host, and there are four main rules. IP refers to an IP address, and NETMASK refers to a subnet mask, such as 10.0.0.0 / 8.

[0031] Specify the filter table, configure the FORWARD chain, specify the protocol (IPV4 or IPV6), such as the IPV4 address, specify the destination address as an IPV4 address / subnet mask, specify the port that can pass as port 80, and specify the filter action as accept. For example: ebtables -t filter -I FORWARD -p IPv4 --ip-dst 10.0.0.0 / 8 --ip-proto tcp--ip-dport 80 -j ACCEPT.

[0032] Since data is bidirectional, after data is sent to the corresponding port of the honeypot, the corresponding port needs to generate a data packet response. Therefore, ebtables specifies the filter table, configures the FORWARD chain, specifies the protocol (IPV4 or IPV6), such as the IPV4 address, specifies the source address as the same A segment address, specifies the port that can pass as port 80, and specifies the filtering action as accept. For example: ebtables -t filter -I FORWARD -p IPv4 --ip-dst 10.0.0.0 / 8 --ip-prototcp --ip-sport 80 -j ACCEPT.

[0033] An IP address consists of two parts, the network address and the host address. Class A addresses are generally used for large networks, Class B addresses are generally used for medium-sized networks; Class C addresses are generally used for small networks; Class D addresses are multicast addresses; and Class E addresses are reserved for future use. Since the honeypot needs to be deployed over a large area to cover the network, the A segment address is selected for operation.

[0034] After specifying all the ports that can be allowed to pass, specify the same address and the target address as the filter action DROP. For example, ebtables -t filter -A FORWARD -p IPv4 --ip-dst 10.0.0.0 / 8 --ip-proto tcp -j DROP.

[0035] Specify the same address, specify the filtering action of the FORWARD chain data packet whose source is the IP address as DROP. For example, ebtables -t filter -A FORWARD -p IPv4 --ip-src 10.0.0.0 / 8 --ip-proto tcp -jDROP). In this way, the specified address can include all IP addresses included in 10.0.0.0 / 8. If there are addresses or ports in other network segments, they can be added as above. After adding once and saving it to the configuration file, you can execute ebtables rules for data packet filtering in the future.

[0036] The invention discloses a general method for preventing a jump board machine based on Ethernet bridge rules. The method is implemented in a honeynet environment with a certain scale. The method adopts a configuration mode of filtering data packets by Ethernet bridges. The method uses ebtables, a configuration tool for filtering data packets at the data link layer in the Linux kernel, to configure the method. When a data packet is sent to a Linux host machine, the host machine detects and processes the filtering rules of the data packet and filters the data packet. Since the honeypot deployed by multiple VLANs is bridged on the Linux host machine, when an attacker attacks the honeypot, ebtables is used to restrict the FORWARD chain. The FORWARD chain rules do not enter the user control and are responsible for forwarding data packets that flow through the host but do not enter the local machine. The invention adopts an Ethernet bridge rule to bridge multiple VLANs on the Linux host machine to create a large number of honeypots, forming a honeynet deployed on a large scale. By limiting and allowing the operation of port traffic, the honeypot is independent of the real business and performs an anti-jump board operation. It is easier to manage the honeypot anti-jumpboard on the host machine than to perform the anti-jumpboard operation directly on the honeypot. It also avoids the failure of the anti-jumpboard mechanism after the honeypot is compromised, allowing the operation and maintenance personnel to directly control the traffic through the Ethernet bridge firewall, making the honeypot system have more powerful firewall capabilities, and performing more convenient and secure anti-jumpboard configuration after large-scale deployment of the honeynet.

[0037] As described above, although the present invention has been shown and described with reference to specific preferred embodiments, it should not be construed as limiting the present invention itself. Various changes may be made to it in form and detail without departing from the spirit and scope of the present invention as defined in the appended claims.

Claims

1. A general method for preventing a jump board based on Ethernet bridge rules, characterized in that: The following steps are involved: Step 1: Bridge multiple honeypots deployed in multiple VLANs to the Linux host so that all network traffic destined for the honeypots is forwarded through the Linux host; Step 2: Use the Ethernet bridge to filter the data packets. When the data packets reach the data link layer, use the configuration tool ebtables in the Linux kernel to filter the data link layer data packets and configure the rules for filtering the data packets. From entering to leaving the system, the data packets go through five stages: PreRoute, Input, Forward, Output, and PostRoute. Each stage includes multiple nodes, and each node is a filtering opportunity. When the data packet reaches a certain node, the anti-jump board system based on the Ethernet bridge rules detects the filtering rules of the corresponding node and filters it. Step 3: After configuration, when a data packet is sent to the Linux host, the Linux host detects the filtering rules for the data packet and performs filtering; Step 4: When the attacker attacks the honeypot, use ebtables to restrict the FORWARD chain. Ebtables is used to filter Ethernet frames. Specify the filter table, configure the FORWARD chain, specify the IPV4 or IPV6 protocol, and after specifying all the ports allowed to pass, specify the same address, specify the filtering action of the target address as discard, and specify the filtering action of the FORWARD chain data packet with the same source as the same address as discard. When configuring the FORWARD parameters, discard the frames from the honeypot to the real business and release the attacker's frames to the honeypot.

2. A general method for preventing a jump board based on Ethernet bridge rules according to claim 1, characterized in that: The configuration of ebtables is divided into three levels: table, chain and rule. Each chain has a series of rules, and each rule defines a series of filtering options.

3. A general method for preventing a jump board based on Ethernet bridge rules according to claim 1, characterized in that: The honeypot is a bridged Kvm virtual machine.

4. A general method for preventing a jump board based on Ethernet bridge rules according to claim 1, characterized in that: The filtering rules are ebtables Ethernet bridge firewall rules configured on the Linux host machine.

Images